First login

Overview

First sign-in establishes your session, portal access, and MFA state before you reach company data.

Where in the app

• Sign in (public) — /auth/login

Step-by-step

1. Open the login URL for your organization. (Expected: email/password form.) (UAT-C-AUTH-LOGIN-001)
2. Submit valid credentials. (Expected: redirect or nextStep for MFA setup/verify.) (UAT-C-AUTH-LOGIN-001)
3. Complete MFA enrollment or verification when prompted. (Expected: session cookie set; no bearer token in browser storage.) (UAT-T-SEC-MFA-001)
4. Land on portal selection or default company dashboard. (Expected: X-Portal context matches membership.) (UAT-C-AUTH-LOGIN-001)
5. If credentials fail, read the localized error—do not retry with the same password more than rate-limit allows. (UAT-C-AUTH-LOGIN-001)
6. Review the audit trail on the record. (Expected: activity event with actor and timestamp.) (UAT-C-AUTH-LOGIN-001)

Password expiry and reminders

When your organization enforces password rotation, Profile → Security shows the expiry date and remaining days. Numezis sends deduplicated reminders 3 days and 1 day before expiry to users with a healthy email address. An expired password must be changed before normal access continues; the new password must satisfy the current policy and cannot reuse a protected password-history entry. (UAT-C-AUTH-PASSWORD-EXPIRY-001)

If you authenticate only through SSO and do not have a local password, the local-password expiry policy does not apply.

Permissions and modules

Public auth routes; no company module until portal bootstrap completes.

Related

• invite team
• company